Fix what an independent review of the published repo turned up

- CI pinned Node 20, but `node --test` with type stripping needs 22.6, so the
  workflow could never have gone green. CI and `engines` now say 22.6.
- `docker compose up -d` failed on the documented path: the compose files
  require DB_PASSWORD and .env.example never mentioned it. Documented, and the
  README no longer claims "three secrets".
- The secret scanner treated any comment line as safe, so a pasted `.env`
  fragment — the usual way a key gets committed — slipped through. Verified
  against planted keys before and after.
- Module pages were not guarded: with KLARBILD_MODULES=print a signed-in user
  could still open /shares, /library and /queue and read about features the
  instance does not have. They now redirect, matching the API's 404 behaviour.
- German left in the English build: `bild.<ext>` as a download fallback, and
  31 t() keys with no German at all — the whole main navigation among them, so
  a German instance rendered its nav in English. Dictionary now covers every
  key in the source (1,067 entries).
- Third-party names removed from the data as well as the labels: the `theframe`
  format id is now `tv169`, and the dead Cricut admin field is gone.
- Dockerfile ignored the committed lockfile; it now copies it and uses `npm ci`.
- Dropped an unused dependency (@aws-sdk/s3-request-presigner — storage.ts
  explains why presigned URLs are not needed), a dead `/g/` entry in the
  unauthenticated path list, and an undocumented N8N_WEBHOOK_URL that nothing
  read. Documented TRUSTED_PROXIES, which the rate limiter does read.
- Migration 004 still had "nas" in its filename; README said A6–A2 where the
  list runs A6–A1; two committed screenshots were referenced nowhere.

124 tests green, type check clean, build clean, secret scan clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nh4A79bbqT9dcd2inzYUdg

.env.example

@@ -2,12 +2,15 @@
 #
 # Copy to .env and fill in. Never commit the real file.
 # Everything below the first block is optional: Klarbild starts, and the print
-# studio works, with nothing but DATABASE_URL, SESSION_SECRET and ENCRYPTION_KEY.
+# studio works, with nothing but a database, SESSION_SECRET and ENCRYPTION_KEY.
 
 # ─────────────────────────────────────────────────────────────────────────────
 # 1. The minimum — this is all a print-only instance needs
 # ─────────────────────────────────────────────────────────────────────────────
 
+# The compose files build DATABASE_URL from DB_PASSWORD, so with Docker you set
+# only the password here. Running from source, set DATABASE_URL yourself instead.
+DB_PASSWORD=CHANGEME
 DATABASE_URL=postgres://klarbild:CHANGEME@db:5432/klarbild
 
 # Signs the session cookie. Any long random string.
@@ -43,6 +46,12 @@ KLARBILD_TZ=Europe/Berlin
 
 PORT=4321
 
+# How many reverse proxies sit in front of this instance. The rate limiter reads
+# the client address that many hops from the right of X-Forwarded-For, so a wrong
+# number here lets a client either spoof its address or share someone else's
+# limit. One proxy (Caddy, nginx, Traefik, Coolify) is the default.
+TRUSTED_PROXIES=1
+
 # ─────────────────────────────────────────────────────────────────────────────
 # 2. First start
 # ─────────────────────────────────────────────────────────────────────────────
@@ -111,9 +120,6 @@ S3_ACCESS_KEY=
 S3_SECRET_KEY=
 S3_FORCE_PATH_STYLE=true
 
-# ─────────────────────────────────────────────────────────────────────────────
-# 9. Optional
-# ─────────────────────────────────────────────────────────────────────────────
-# A webhook that gets a POST when a job finishes — for n8n and the like.
-
-N8N_WEBHOOK_URL=
+# A webhook that fires when a job finishes — for n8n and the like — is set in the
+# admin area rather than here, because it is a per-instance setting rather than a
+# secret.